Secrets Management Best Practices

What this best practices guide is

A practical guide to secrets management for developers who build and deploy apps. It covers where secrets should live, keeping them out of git and catching leaks, least privilege, rotation, CI/CD with OIDC instead of long-lived keys, what the browser can and cannot see, log redaction, and what to do in the first hour after a leak.

It has 7 chapters and 28 practices, each with why it matters, what to do and what to avoid. For developers who deploy apps.

Chapter by chapter

1. Where secrets should live (5 practices)

The right home for a secret depends on the size of your team and setup, but there are a few places a secret should never be.

2. Catching leaks before and after they happen (4 practices)

Tools that stop secrets reaching a repository, and the order of steps when one gets through.

3. Least privilege and short-lived credentials (4 practices)

Limit what each secret can do and how long it works, so a leak causes as little damage as possible.

4. Rotation (3 practices)

Replacing secrets on a schedule and on demand, without downtime.

5. CI/CD secrets and OIDC (5 practices)

Pipelines hold the keys to production, so treat them like production: short-lived credentials, narrow trust and reviewed changes.

6. Frontend versus backend secrets (4 practices)

Anything shipped to the browser or a mobile app is public. This chapter is about drawing that line clearly.

7. Logging, redaction and incident response (3 practices)

Keep secrets out of the logs you collect, and know exactly what to do in the first hour after a leak.

How it works on Sefism

The guide reads like a short course: a syllabus, then one chapter per page in a focused reader, with a quiz at the end of each chapter for members. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (8 cited).